Correlate Findings

Because the same issue is often visible to more than one source, normalized findings still need to be matched against each other before you see them. Correlation is the stage where ETM recognizes when two or more incoming records describe the same underlying finding on the same asset, and consolidates them into a single, trustworthy record.

Navigate to: Risk Management > Findings Rule

Identify: Matching Records to a Single Finding

Identification rules compare the normalized attributes of an incoming record — such as CVE ID, port, protocol, CPE ID, or title — against existing findings on the same asset. The first matching condition wins, and the identification evaluation stops there; if nothing matches, a new finding record is created. ETM applies dedicated identification rules for host vulnerabilities, web application vulnerabilities, and misconfigurations.

Merge: Consolidating Matched Records

Once records are identified as duplicates, merge rules combine them into one aggregated finding. Attribute conflicts — for example two different status values or last-detected dates — are resolved by precedence, using source trust ranking or a custom merge configuration you define, while keeping a link back to every contributing source record.

Purge: Retiring Stale Findings

Purge rules clean up findings that are no longer relevant — for example those tied to a decommissioned connector or that haven't been seen in a defined period — keeping your findings list current.

AI-based Findings Consolidation Engine 2.0

For vulnerability findings, an AI-based consolidation engine handles identification and merging automatically, including lifecycle-aware consolidation as new scans arrive over time. Misconfiguration findings continue to use configurable merge rules.

This is a concept-level summary. For step-by-step configuration of identification, merge, and purge rules, see the topics listed under Related Topics.